ANS-C01 Practice Test 8 — 10 Questions

Question 1

A company uses AWS Direct Connect to connect their on-premises network to a VPC. They have a private virtual interface (VIF) with a BGP session. The on-premises router is advertising a default route (0.0.0.0/0) to the VPC. The company wants to ensure that traffic from the VPC to the internet does not use the Direct Connect connection, but instead uses a NAT gateway. However, they still want to use Direct Connect for traffic to specific on-premises prefixes. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advertise a more specific route for on-premises prefixes from the on-premises router, and configure the VPC route table with a static route for 0.0.0.0/0 to the NAT gateway. Ensure that the on-premises router does not advertise a default route.. The VPC route table uses longest prefix match. If the on-premises router advertises a default route (0.0.0.0/0), it will be propagated to the VPC route table and compete with the NAT gateway route. To ensure internet traffic uses the NAT gateway, the on-premises router must not advertise a default route. Instead, it should advertise only specific on-premises prefixes. Then, a static default route to the NAT gateway will handle internet traffic, and the more specific on-premises routes will direct traffic over Direct Connect. This provides the desired split.

Answer

Create a route in the VPC route table for 0.0.0.0/0 pointing to the virtual private gateway, and a more specific route for on-premises prefixes pointing to the NAT gateway.

Answer

Configure a route in the VPC route table for 0.0.0.0/0 pointing to the NAT gateway, and remove the default route propagation from the Direct Connect virtual private gateway.

Answer

Use a prefix list for on-premises prefixes and associate it with the Direct Connect gateway. Configure the VPC route table to use the prefix list for on-premises traffic and a default route to the NAT gateway.

Question 2

A company has a VPC with a NAT gateway in a public subnet. The security team wants to log all outbound traffic from private subnets to the internet. Which AWS service should be used to capture this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, bytes, action) for network interfaces in a VPC, including traffic traversing a NAT gateway from private subnets to the internet. They can be published to CloudWatch Logs or S3 and are the correct tool for logging outbound traffic flows. This directly satisfies the requirement to log all outbound traffic from private subnets.

Answer

AWS CloudTrail

Answer

Amazon S3 Access Logs

Answer

AWS Config

Question 3

A company wants to ensure that all traffic to and from its Amazon EC2 instances in a VPC is inspected by a third-party security appliance. The instances are in private subnets and must maintain their private IP addresses. Which solution should be used?

Accepted Answer

Configure a Gateway Load Balancer and Gateway Load Balancer endpoints in the VPC. Gateway Load Balancer (GWLB) with Gateway Load Balancer endpoints (GWLBe) allows you to insert third-party appliances inline for traffic inspection without changing the instances' private IP addresses. The GWLB acts as a transparent layer between the VPC and the appliance, inspecting all traffic. Option A is incorrect because a Transit Gateway with a site-to-site VPN does not provide inline inspection without modifying the routing and IP addresses. Option C is incorrect because VPC Peering does not inherently provide traffic inspection; you would still need to route traffic through an appliance. Option D is incorrect because a Network Load Balancer is designed for load balancing, not for inline inspection of all traffic.

Answer

Deploy a Transit Gateway with a site-to-site VPN to the appliance

Answer

Use VPC Peering to connect to a central inspection VPC

Answer

Set up a Network Load Balancer in front of the instances

Question 4

A company needs to block traffic from a specific IP address range in their VPC. Which component should be used?

Accepted Answer

Network ACL. Network ACLs (NACLs) are stateless, subnet-level firewalls that support both allow and deny rules, making them the only VPC component that can explicitly block traffic from a specific IP range. Security groups are stateful and only support allow rules, so they cannot deny traffic. Route tables and internet gateways control routing, not filtering. Thus, to block a CIDR range, you must use a NACL with a deny rule for that range.

Answer

Route table

Answer

Internet gateway

Answer

Security group

Question 5

A network engineer manages a VPC that uses a NAT gateway in a public subnet for outbound internet access from private subnets. After a new application was deployed, users report that outbound HTTPS requests from the private subnets intermittently fail with connection timeouts, while some requests succeed. The NAT gateway's CloudWatch metrics show high ActiveConnectionCount and ErrorPortAllocation spikes. Which action should the engineer take to resolve the intermittent failures?

Accepted Answer

Distribute outbound traffic across multiple NAT gateways in different Availability Zones and reduce connection reuse in the application.. ErrorPortAllocation occurs when a NAT gateway cannot allocate a source port for a new connection, typically because of many simultaneous connections to the same destination. Distributing egress across multiple NAT gateways in different AZs expands the source port capacity, and reducing connection reuse in the application lowers the concurrent demand that exhausts the port pool.

Answer

Increase the NAT gateway's bandwidth by enabling a second elastic IP address on the same NAT gateway.

Answer

Replace the NAT gateway with a NAT instance and configure a larger connection tracking table.

Answer

Add a route to the private subnet route table pointing the destination CIDR to an internet gateway.

Question 6

A company runs a hybrid workload where an on-premises application server must reach an EC2 instance in a VPC over an AWS Site-to-Site VPN. The VPN uses a virtual private gateway, and the on-premises router advertises 10.10.0.0/16 while the VPC CIDR is 10.20.0.0/16. The on-premises server can ping the EC2 instance, but TCP connections to port 443 time out. The VPC route table has a route for 10.10.0.0/16 pointing to the virtual private gateway, and the EC2 security group allows 10.10.0.0/16 on port 443. Which is the most likely cause?

Accepted Answer

The network ACL on the subnet containing the EC2 instance is blocking inbound TCP port 443 from the on-premises CIDR.. The protocol-specific failure is the key clue: ICMP succeeds while TCP 443 times out. Network ACLs are stateless and evaluated per direction, so an inbound rule that omits TCP 443 from the on-premises CIDR drops the SYN while allowing ICMP. Security groups are stateful and already permit the source, so the ACL is the most likely culprit.

Answer

The EC2 instance is in a private subnet and therefore cannot accept traffic from on-premises networks.

Answer

The virtual private gateway does not support BGP, so the on-premises prefix is not learned.

Answer

The VPN tunnel is down, so no traffic can pass between the on-premises network and the VPC.

Question 7

A company has a large AWS environment with hundreds of VPCs connected via a Transit Gateway. The network team is implementing a new hub-and-spoke architecture where all traffic between VPCs must be inspected by a centralized firewall appliance in a shared services VPC. The firewall appliance is a third-party virtual appliance that supports VRF-like segmentation. The network engineer has configured the Transit Gateway with separate route tables for each VPC, and the shared services VPC is associated with all route tables. The firewall appliance is deployed in the shared services VPC with two ENIs: one in a 'trust' subnet and one in an 'untrust' subnet. The trust subnet is used for traffic coming from spoke VPCs, and the untrust subnet is used for traffic going to other spoke VPCs. The firewall appliance performs stateful inspection and returns traffic to the Transit Gateway via the correct ENI. However, after implementation, traffic between two spoke VPCs (VPC A and VPC B) is being dropped. The engineer verifies that the Transit Gateway route tables have static routes for each spoke VPC CIDR pointing to the shared services VPC attachment. The spoke VPCs have routes to each other's CIDR via the Transit Gateway. The firewall logs show that traffic from VPC A reaches the trust ENI, but the firewall is unable to send traffic to VPC B because it does not have a route to VPC B's CIDR. What is the most likely cause?

Accepted Answer

The route table for the untrust subnet does not have a route to VPC B's CIDR pointing to the Transit Gateway.. The firewall's untrust subnet route table must have a route pointing to the Transit Gateway for VPC B's CIDR. The firewall receives traffic from VPC A on its trust ENI, processes it, and then sends it out the untrust ENI. Without a route in the untrust subnet's route table directing traffic for VPC B's CIDR to the Transit Gateway, the firewall cannot forward the traffic back to the Transit Gateway for delivery to VPC B, causing the drop.

Answer

The shared services VPC attachment is not propagating routes to the Transit Gateway route tables.

Answer

The security group for the firewall's untrust ENI is blocking outbound traffic.

Answer

The Transit Gateway route table for VPC A does not have a route for VPC B's CIDR.

Question 8

A company is designing a multi-VPC architecture with VPC peering. They need to ensure that traffic between VPCs is encrypted. What should they do?

Accepted Answer

Use a third-party VPN appliance in each VPC to create an IPsec tunnel between them. VPC peering does not encrypt traffic natively. To ensure encryption between VPCs, you need to establish an IPsec tunnel, which can be achieved by deploying a third-party VPN appliance in each VPC. Option B is incorrect because a VPN connection using virtual private gateways is typically used to connect a VPC to an on-premises network, not directly between VPCs. Option C is incorrect because VPC peering does not support enabling encryption on the peering connection itself; encryption must be added via an overlay. Option D is incorrect because AWS Direct Connect is used for dedicated connections to on-premises data centers, not for inter-VPC traffic.

Answer

Establish a VPN connection between the VPCs using virtual private gateways

Answer

Enable encryption on the VPC peering connection

Answer

Use AWS Direct Connect to connect the VPCs

Question 9

A company wants to use AWS Direct Connect to connect their on-premises network to a VPC. They have two Direct Connect locations and want high availability. What is the minimum number of Direct Connect virtual interfaces needed?

Accepted Answer

Two private VIFs. For high availability across two Direct Connect locations, you need at least two private virtual interfaces (VIFs), one at each location, each connecting to the same VPC. This ensures that if one Direct Connect connection or location fails, traffic can still flow through the other private VIF. A single private VIF provides no redundancy, and public VIFs are used for accessing public AWS services, not VPC connectivity.

Answer

One public VIF and one private VIF

Answer

Four private VIFs

Answer

One private VIF

Question 10

A company needs to encrypt data at rest in Amazon S3. Which AWS service manages the encryption keys?

Accepted Answer

AWS KMS. AWS KMS (Key Management Service) is the AWS service that manages encryption keys for Amazon S3. AWS KMS allows you to create, rotate, and control access to encryption keys used to encrypt data at rest in S3. Option A (AWS Secrets Manager) is incorrect because it manages secrets like database credentials, not encryption keys for S3. Option B (AWS Certificate Manager) is incorrect because it manages SSL/TLS certificates, not encryption keys. Option C (AWS CloudHSM) is incorrect because while it provides hardware security modules for key storage, it is not the default or primary key manager for S3; AWS KMS is the integrated service for S3 encryption.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Answer

AWS CloudHSM